Web Service Security Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:29:10Z

Point to the official site

Dominique RIGHETTO: Migration to GitHub of the project

2019-02-16T15:59:24Z

Migration to GitHub of the project

Jmanico: /* Other Cheatsheets */

2017-09-11T06:14:39Z

‎Other Cheatsheets

Jmanico: /* Introduction */

2015-08-04T19:33:30Z

‎Introduction

Jmanico at 19:33, 4 August 2015

2015-08-04T19:33:19Z

Jmanico: moving nav to bottom for mobile friendliness

2015-07-18T23:15:26Z

moving nav to bottom for mobile friendliness

Jmanico: removing SSL it needs to go

2015-04-28T03:39:51Z

removing SSL it needs to go

Jmanico at 03:33, 8 April 2014

2014-04-08T03:33:28Z

Jmanico at 13:02, 20 March 2014

2014-03-20T13:02:23Z

Jmanico: /* Related Pages */

2012-07-09T10:52:23Z

‎Related Pages

← Older revision		Revision as of 14:29, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/Web_Service_Security_Cheat_Sheet.md Web Service Security Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Web_Service_Security_Cheat_Sheet.html Web Service Security Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 2: / Line 2: @@
 <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>
-{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
+The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!
-= Introduction  =
+Please visit [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Web_Service_Security_Cheat_Sheet.md Web Service Security Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 130: / Line 130: @@
 [mailto:jim@owasp.org Jim Manico]
-== Other Cheatsheets ==
+= Other Cheatsheets =
 {{Cheatsheet_Navigation_Body}}

@@ Line 6: / Line 6: @@
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
   __TOC__{{TOC hidden}}
 = Introduction  =
 This article is focused on providing guidance to securing web services and preventing web services related attacks. Please notice that due to the difference of implementation between different frameworks, this cheat sheet is kept at a high level.

@@ Line 5: / Line 5: @@
 | valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 = Introduction  =
 This article is focused on providing guidance to securing web services and preventing web services related attacks. Please notice that due to the difference of implementation between different frameworks, this cheat sheet is kept at a high level.

@@ Line 13: / Line 13: @@
 Transport confidentiality protects against eavesdropping and man-in-the-middle attacks against web service communications to/from the server.
-'''Rule''' - All communication with and between web services containing sensitive features, an authenticated session, or transfer of sensitive data must be encrypted using well configured TLS. This is recommended even if the messages themselves are encrypted because SSL/TLS provides numerous benefits beyond traffic confidentiality including integrity protection, replay defenses, and server authentication. For more information on how to do this properly see the [[Transport Layer Protection Cheat Sheet]].
+'''Rule''' - All communication with and between web services containing sensitive features, an authenticated session, or transfer of sensitive data must be encrypted using well configured TLS. This is recommended even if the messages themselves are encrypted because TLS provides numerous benefits beyond traffic confidentiality including integrity protection, replay defenses, and server authentication. For more information on how to do this properly see the [[Transport Layer Protection Cheat Sheet]].
 == Server Authentication  ==
-'''Rule''' - SSL/TLS must be used to authenticate the service provider to the service consumer. The service consumer should verify the server certificate is issued by a trusted provider, is not expired, is not revoked, matches the domain name of the service, and that the server has proven that it has the private key associated with the public key certificate (by properly signing something or successfully decrypting something encrypted with the associated public key).
+'''Rule''' - TLS must be used to authenticate the service provider to the service consumer. The service consumer should verify the server certificate is issued by a trusted provider, is not expired, is not revoked, matches the domain name of the service, and that the server has proven that it has the private key associated with the public key certificate (by properly signing something or successfully decrypting something encrypted with the associated public key).
 == User Authentication ==
@@ Line 23: / Line 23: @@
 User authentication verifies the identity of the user or the system trying to connect to the service. Such authentication is usually a function of the container of the web service.
-'''Rule''' - If used, Basic Authentication must be conducted over SSL, but Basic Authentication is not recommended.
+'''Rule''' - If used, Basic Authentication must be conducted over TLS, but Basic Authentication is not recommended.
-'''Rule''' - Client Certificate Authentication using SSL is a strong form of authentication that is recommended.
+'''Rule''' - Client Certificate Authentication using TLS is a strong form of authentication that is recommended.
 == Transport Encoding  ==
@@ Line 35: / Line 35: @@
 == Message Integrity  ==
-This is for data at rest. Integrity of data in transit can easily be provided by SSL/TLS.
+This is for data at rest. Integrity of data in transit can easily be provided by TLS.
 When using public key cryptography, encryption does guarantee confidentiality but it does not guarantee integrity since the receiver's public key is public. For the same reason, encryption does not ensure the identity of the sender.

@@ Line 1: / Line 1: @@
 = Introduction  =
@@ Line 122: / Line 127: @@
 [mailto:dave.wichers@owasp.org Dave Wichers] <br/>
 [mailto:jim@owasp.org Jim Manico]
-= Other Cheatsheets =
+|}
 [[Category:Cheatsheets]]